Check a site
Check a website Service status Outages Blog
All tools
Check a websiteBrowse all tools
A sitemap.xml file in a code window with one line highlighted red for an unescaped ampersand, above tags reading 50,000 URLs, 50 MB uncompressed and UTF-8

Guides

XML sitemaps search engines can read: limits and common errors

Posted Jimel S.4 min read

One unescaped character can stop a crawler reading the rest of your sitemap. Here’s what belongs in an XML sitemap, the limits set by sitemaps.org and Google, the errors that break it, and how to validate yours.

Illustration: UtiBox

Your sitemap looks fine in the browser, yet Search Console reports a problem with it, or new pages take far longer to be found than they should. Sitemaps fail quietly. A single bad character can stop the rest of the file being read, and nothing on your site looks broken.

This guide covers what goes in a sitemap, the limits, the errors that break one most often, and how to check yours.

What a sitemap is, and what it isn’t

An XML sitemap is a list of the pages you want search engines to find, with an optional date for when each last changed. The format is defined by the sitemaps.org protocol (opens in a new tab). A minimal one looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://www.example.com/guides/oak-tables</loc>
    <lastmod>2026-11-02</lastmod>
  </url>
</urlset>

It’s a hint, not an instruction. Google’s sitemap documentation (opens in a new tab) says “submitting a sitemap is merely a hint: it doesn’t guarantee that Google will download the sitemap or use the sitemap for crawling URLs on the site.” A clean sitemap helps pages get found. It can’t force them into results.

What goes in

  • Only the URLs you want in search results. If the same content is reachable at several addresses, Google says to choose the one you prefer and list that one.
  • Full, absolute URLs. Google says to “use fully-qualified, absolute URLs”, so https://www.example.com/guides/oak-tables, never /guides/oak-tables.
  • An honest lastmod. Google uses it “if it’s consistently and verifiably” accurate. It should reflect the last significant change to the page, such as the main content or links, and not something like an updated copyright year.
  • changefreq and priority are optional. The protocol defines them, but Google says plainly: “Google ignores <priority> and <changefreq> values.” Other search engines may treat them differently.

The limits

RuleLimit
URLs in one sitemap50,000
File size50 MB (52,428,800 bytes) uncompressed, even if you gzip it
Sitemaps listed in one sitemap index50,000
Length of a <loc> URLLess than 2,048 characters
EncodingUTF-8, with special characters entity-escaped
HostsEvery URL on the same host and protocol as the sitemap

All of these come from the sitemaps.org protocol, and Google’s documentation repeats the 50 MB and 50,000-URL limits. Over either one, split the list into several sitemaps and list those in a sitemap index.

Location matters too. Google says that unless you submit it through Search Console, “a sitemap affects only descendants of the parent directory”, so a sitemap at the site root can cover the whole site.

The errors that break sitemaps

  1. An unescaped ampersand. A URL like ?colour=red&size=4 must be written ?colour=red&amp;size=4 inside the XML. A bare & or < is an XML syntax error, and a parser stops there.
  2. Relative URLs, usually from a template that prints the path without the domain.
  3. Dates in the wrong format. lastmod uses W3C Datetime: 2026-11-02 or 2026-11-02T10:00:00+00:00, never 02/11/2026.
  4. Made-up values. changefreq must be one of always, hourly, daily, weekly, monthly, yearly or never, and priority must be between 0.0 and 1.0.
  5. The wrong host. A sitemap on https://www.example.com that lists https://example.com pages, or http:// ones, after a domain or HTTPS move.
  6. A missing or misspelt namespace on <urlset>.
  7. A sitemap that isn’t a sitemap: the address answers 404, or redirects to the home page and returns HTML.

Validate with the Sitemap Validator

Paste a sitemap address into the Sitemap Validator and press Validate. If you paste just the site address, it takes the first Sitemap: line in your robots.txt, or tries /sitemap.xml if there isn’t one.

We fetch the file from our server, read up to 5 MB of it (and say so if it’s bigger), and unpack gzip files whatever they’re called. Then:

  • The summary shows how many URLs or child sitemaps the file lists, its size and how it was found.
  • The stats show the share of entries with a lastmod date, and the number of errors and warnings.
  • Errors break the rules above: a missing <loc>, a URL that isn’t a full http or https address, a URL over 2,048 characters or containing spaces, a date that isn’t W3C format, or a changefreq or priority outside the allowed values. An XML syntax error is reported with its line number, because nothing after it was read. If the root element isn’t <urlset> or <sitemapindex>, that’s an error too.
  • Warnings cover duplicate URLs, URLs on a different host, a wrong or missing namespace, an empty sitemap and lastmod dates more than two days in the future.

For a sitemap index, you get a table of the child sitemaps with a Validate link beside each one. For a plain sitemap, you see the first 15 URLs. If the address returns an error code instead of a file, the validator tells you which code and stops.

Once it passes

  • Point to it from robots.txt with a line such as Sitemap: https://www.example.com/sitemap.xml. Google says the line can go anywhere in the file, and you can list several. The robots.txt Tester lists the Sitemap: lines it finds, each linked to the validator.
  • Submit it to Google in the Search Console Sitemaps report, or with the Search Console API.
  • Check again after changes: a new SEO plugin, a CMS upgrade, a move to HTTPS or a new domain. Those are the moments sitemaps quietly break.

Validate your sitemap

Related

More from Guides

Most read

Latest

Most read

  1. 01November Patch Tuesday lands on the 10th: what October’s record release tells us19
  2. 02Introducing UtiBox: the Web’s Utility Box2
  3. 03Ivanti Connect Secure zero-days gave attackers root on VPN gateways1
  4. 04“Black October”: attackers raid secrets at cloud and AI developer platforms1

Embed this post

Paste this code into your page. It shows the post as a card that links back here. In WordPress you can also paste the post’s address on a line of its own.

Cookies on UtiBox

UtiBox is free because of ads. Google and its partners use cookies to show, limit and measure ads, Google Analytics, Ahrefs Web Analytics and Microsoft Clarity show us how the site is used, and we use a few essential cookies to run the site.